BUG/MINOR: acl: req_ssl_sni fails with SSLv3 record version

SNI is a TLS extension and requires at least TLSv1.0 or later, however
the version in the record layer may be SSLv3, not necessarily TLSv1.0.

GnuTLS for example does this.

Relax the record layer version check in smp_fetch_ssl_hello_sni() to
allow fetching SNI values from clients indicating SSLv3 in the record
layer (maintaining the TLSv1.0+ check in the actual handshake version).

This was reported and analyzed by Pravin Tatti.
BUG/MINOR: build: add missing objects in osx and bsd Makefiles

Commits 98634f0c7b8, ed66c297c26 and d5f624dde78 updated the main
makefile with new objects src/hash.o, src/pattern.o and src/map.o,
but missed to update Makefile.bsd and Makefile.osx.

This will fix some of the build failures reported by Jorge Severino
under OpenBSD.
DOC: fix a few config typos.

Here's a small patch that fixes a few typos in
configuration.txt (and one in haproxy.1).
BUILD/MEDIUM: standard: get rid of the last strcpy()

OpenBSD complains about our use of strcpy() in standard.c. The checks
were OK and we didn't fall into the category of "almost always misused",
but it's very simple to fix it so better do it before a problem happens.

src/standard.o(.text+0x26ab): In function `str2sa_range':
src/standard.c:718: warning: strcpy() is almost always misused, please use strlcpy()
BUILD/MEDIUM: standard: get rid of sprintf()

OpenBSD complains about the use of sprintf in human_time() :

src/standard.o(.text+0x1c40): In function `human_time':
src/standard.c:2067: warning: sprintf() is often misused, please use snprintf()

We can easily get around this by having a pointer to the end of the string and
using snprintf() instead.
BUILD/MEDIUM: cfgparse: get rid of sprintf()

A few occurrences of sprintf() were causing harmless warnings on OpenBSD :

src/cfgparse.o(.text+0x259e): In function `cfg_parse_global':
src/cfgparse.c:1044: warning: sprintf() is often misused, please use snprintf()

These ones were easy to get rid of, so better do it.
BUILD/MEDIUM: checks: get rid of sprintf()

OpenBSD complains about our use of sprintf() here :

src/checks.o(.text+0x44db): In function `process_chk':
src/checks.c:766: warning: sprintf() is often misused, please use snprintf()

This case was not really clean since the introduction of global.node BTW.
Better change the API to support a size argument in the function and enforce
the limit.
BUILD/MEDIUM: http: remove calls to sprintf()

OpenBSD complains about this use of sprintf() :

src/proto_http.o(.text+0xb0e6): In function `http_process_request':
src/proto_http.c:4127: warning: sprintf() is often misused, please use snprintf()

Here there's no risk as the strings are way shorter than the buffer size
but let's fix it anyway.
BUG/MEDIUM: systemd-wrapper: fix locating of haproxy binary

OpenBSD complains this way due to strncat() :

src/haproxy-systemd-wrapper.o(.text+0xd5): In function `spawn_haproxy':
src/haproxy-systemd-wrapper.c:33: warning: strcat() is almost always misused, please use strlcat()

In fact, the code before strncat() here is wrong, because it may
dereference a NULL if /proc/self/exe is not readable. So fix it
and get rid of strncat() at the same time.

No backport is needed.
BUG/MINOR: build: handle whitespaces in wc -l output

Certain implementations (for example ksh/OpenBSD) prefix the
'wc -l' output with whitespaces. This breaks the build since
689e4d733 ("BUILD: simplify the date and version retrieval in
the makefile").

Fix this by piping the wc output into tr -dc '0-9'.

Workaround is to build with IGNOREGIT=1.

HAProxy-1.4 is affected as well.
BUG/MINOR: Fix name lookup ordering when compiled with USE_GETADDRINFO

When compiled with USE_GETADDRINFO, make sure we use getaddrinfo(3) to
perform name lookups. On default dual-stack setups this will change the
behavior of using IPv6 first. Global configuration option
'nogetaddrinfo' can be used to revert to deprecated gethostbyname(3).
MEDIUM: ssl: Add standardized DH parameters >= 1024 bits

This patch adds standardized (rfc 2409 / rfc 3526)
DH parameters with prime lengths of 1024, 2048, 3072, 4096, 6144 and
8192 bits, based on the private key size.
BUILD/MINOR: ssl: remove one call to sprintf()

Lukas reported another OpenBSD complaint about this use of sprintf() that
I missed :

src/ssl_sock.o(.text+0x2a79): In function `bind_parse_crt':
src/ssl_sock.c:3015: warning: sprintf() is often misused, please use snprintf()

This one was even easier to handle. Note that some of these calls could
be simplified by checking the snprintf output size instead of doing the
preliminary size computation.
BUG/MEDIUM: stick-table: fix IPv4-to-IPv6 conversion in src_* fetches

The function addr_to_stktable_key doesn't consider the expected
type of key. If the stick table key is based on IPv6 addresses
and the input is IPv4, the returned key is IPv4 adddress and his
length is 4 bytes, while is expected 16 bytes key.

This patch considers the expected key and try to convert IPv4 to
IPv6 and IPv6 to IPv4 according with the expected key.

This fixes the bug reported by Apollon Oikonomopoulos.

This bug was introduced somewhere in the 1.5-dev process.
MINOR: http: Add the "language" converter to for use with accept-language

language(<value[;value[;value[;...]]]>[,<default>])

	 Returns the value with the highest q-factor from a list as
	 extracted from the "accept-language" header using "req.fhdr".
	 Values with no q-factor have a q-factor of 1. Values with a
	 q-factor of 0 are dropped. Only values which belong to the
	 list of semi-colon delimited <values> will be considered. If
	 no value matches the given list and a default value is
	 provided, it is returned. Note that language names may have
	 a variant after a dash ('-'). If this variant is present in
	 the list, it will be matched, but if it is not, only the base
	 language is checked. The match is case-sensitive, and the
	 output string is always one of those provided in arguments.
	 The ordering of arguments is meaningless, only the ordering
	 of the values in the request counts, as the first value among
	 multiple sharing the same q-factor is used.

	 Example :

	     # this configuration switches to the backend matching a
	     # given language based on the request :

	     acl de req.fhdr(accept-language),language(de;es;fr;en) de
	     acl es req.fhdr(accept-language),language(de;es;fr;en) es
	     acl fr req.fhdr(accept-language),language(de;es;fr;en) fr
	     acl en req.fhdr(accept-language),language(de;es;fr;en) en
	     use_backend german  if de
	     use_backend spanish if es
	     use_backend french  if fr
	     use_backend english if en
	     default_backend choose_your_language
BUG/MINOR: log: Don't dump empty unique-id

If the unique-id value is missing, the build_logline() function dump
anything. It is because the function lf_text() is bypassed. This
function is responsible to dump '-' is the value is not present, and set
the '"' around the value displayed.

This fixes the bug reported by Julient Vehent
BUG/MAJOR: session: fix a possible crash with src_tracked

Since commit 4d4149c ("MEDIUM: counters: support passing the counter
number as a fetch argument"), the sample fetch sc_tracked(num) became
equivalent to sc[0-9]_tracked, by using the same smp_fetch_sc_tracked()
function.

This was theorically made possible after the series of changes starting
with commit a65536ca ("MINOR: counters: provide a generic function to
retrieve a stkctr for sc* and src."). Unfortunately, while all other
functions were changed to use the generic primitive smp_fetch_sc_stkctr(),
smp_fetch_sc_tracked() was forgotten and is not able to differentiate
between sc_tracked, src_tracked and sc[0-9]_tracked. The resulting mess is
that if sc_tracked is used, the counter number is assumed to be 47 because
that's what remains after subtracting "0" from char "_".

Fix this by simply relying on the generic function as should have been
done. The bug was introduced in 1.5-dev20. No backport is needed.
DOC: Update "language" documentation

The example provided with the "language" filter documentation
doesn' run because the match method is not specified.
Merge branch 'master' of http://git.1wt.eu/git/haproxy